UI-TARS-desktop CVE-2026-81735

Exploitable when a pre-commit-c2ad42e build of the @agent-infra/mcp-server-commands or mcp-server-filesystem server is launched through its default entry point, which invokes startSseAndStreamableHttpMcpServer with host and port only - leaving the host to default to '::' (all interfaces) and passing no authentication middleware - AND the listening port (e.g. 8089) is reachable from the attacker's network position. No credentials, user interaction, or non-default flags are needed; the insecure all-interface bind and absent auth are the out-of-the-box behavior. What LIMITS exploitation: the host must actually be reachable on that port - a machine behind NAT or a host firewall that does not forward the MCP port is only locally exploitable despite the all-interface bind - and operators who already pass --host 127.0.0.1 or supply middleware are not exposed. The commands-server path additionally requires the run_command tool to be the exposed capability (it is, by default).

All available signals point to genuine critical risk in exposed deployments. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA:H and subsequent-system SC/SI/SA:H) describes network-reachable, low-complexity, unauthenticated exploitation with full compromise of the host, consistent with the description: a default all-interfaces bind plus optional auth plus a shell-exec tool. The primary real-world limiter is reachability - the impact is severe only where the listening port (e.g. 8089) is actually exposed beyond the local host; a machine behind NAT/firewall with the port not forwarded is only locally exploitable despite the all-interface bind. No EPSS score, POC, or KEV entry is provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation; the severity is driven by impact and trivial exploitability, not by observed campaigns. Note the versioning caveat: the package version stayed 1.2.4 across the fix commit, so scanners keyed on release version cannot distinguish vulnerable from patched builds - a meaningful detection gap.

An attacker scans a network segment for exposed MCP ports and finds a UI-TARS-desktop commands server bound to all interfaces with no authentication. They connect to the /mcp Streamable HTTP endpoint, call the run_command tool with a command such as a reverse-shell one-liner, and child_process.exec runs it as the user hosting the server, granting full interactive control. No public exploit is identified at time of analysis, but the attack requires only a standard MCP client and network reachability (AV:N/AC:L/PR:N).